Overview: BTCPay Server Hot Wallet Thefts Impact Outdated Instances
BTCPay Server, an open-source cryptocurrency payment processor, has issued an urgent advisory regarding ongoing hot wallet thefts targeting instances running outdated software. Threat actors are actively exploiting known vulnerabilities in older versions to drain Bitcoin and Litecoin from user wallets. The project maintainers have strongly urged all users to update their servers to the latest version, 2.4.7, as soon as possible to mitigate the risk of financial loss, according to BleepingComputer.
The BTCPay Server platform allows businesses to self-host payment processing solutions, enabling direct acceptance of cryptocurrencies into their own wallets without intermediaries. This incident highlights the critical importance of maintaining current software versions, particularly for systems handling financial assets.
Technical Analysis of the BTCPay Server Attack Vector
The incident response investigation by BTCPay Server identified an attack vector specifically targeting instances running version 2.4.1 (July 23, 2026) or older. While the exact method of initial compromise for the recent attacks is still under investigation, clues suggest that attackers are exploiting vulnerabilities present in BTCPay Server versions earlier than 2.4.2, which was released on August 7. The project later confirmed these vulnerabilities were indeed being leveraged.
The attacks involve threat actors gaining unauthorized administrative access to these outdated instances, subsequently enabling them to drain “hot wallets” — those online wallets holding funds immediately available for transactions. BTCPay founder Nicolas Dorier noted that these attacks did not target public servers, indicating a focus on specific, vulnerable installations.
This exploitation follows a disclosure on October 29 of a separate critical vulnerability, identified by Anthropic’s Frontier OSS scanner. This discovery prompted the emergency release of version 2.4.7 to address the flaw. However, the current wave of hot wallet drains appears to stem from vulnerabilities predating this specific “critical vulnerability,” affecting versions 2.4.1 and older. There are no credible reports of hot wallet drains for users running the latest 2.4.7 release, reinforcing the urgency of updates.
Understanding the Impact: BTCPay Server 2.4.1 Hot Wallet Theft Prevention
The primary recommendation for all BTCPay Server operators is to update their instances immediately. For users running version 2.4.1 or older, the recommendation is even more stringent: take the instance offline as soon as possible if an immediate update is not feasible. This proactive measure aims to prevent further unauthorized access and cryptocurrency theft.
VPS hosting providers were also advised to take affected server instances offline as a precaution. Users who have unfortunately lost funds due to these attacks are encouraged to report details to security@btcpayserver.org and inform local authorities.
Actionable Recommendations: How to Update BTCPay Server to 2.4.7
To protect against these ongoing threats and prevent hot wallet drains, BTCPay Server users must prioritize updating their systems.
- For self-hosted instances: Navigate to Server Settings → Maintenance → Update.
- For Docker installations: Administrators should log in over SSH, execute
sudo su -, change to the deployment directory withcd btcpayserver-docker, and then run./btcpay-update.sh.
Ensuring your BTCPay Server is running the most current version, 2.4.7, is the most effective defense against the identified attack vectors. Regularly checking for and applying updates is a fundamental security practice, especially for platforms managing sensitive financial assets like cryptocurrencies. This incident serves as a stark reminder of the risks associated with unpatched software in critical financial infrastructure.
Related: Philippines Nuclear Agency Breached via Unpatched ownCloud Flaws, SafePal Data Breach Exposes 39,798 Customer Order Details